New 'Bootkit' Malware Sidesteps Security Software

A newly-identified piece of malware has achieved arguably the ultimate goal of cybercriminals. "Nemesis" is able to infect a Windows computer before the operating system is loaded.

The malware is a particularly nasty form of a rootkit. That's software which is able to inappropriately access some of the core components of a computer (both hardware and software), often disguising its actions. A rootkit is a serious problem because it's often completely undetectable, which means that it can easily override antivirus software to carry out malicious tasks.

In this case, the Nemesis malware goes a step further and infects the hard drive boot record, which is the very first piece of code which executes when a computer is switched on. It's this code which launches an operating system such as Windows; such an infection is also known as a "bootkit" (boot + rootkit).

Bootkit Runs Before Security Software

That brings some major problems. Rootkits (and especially bootkits) can make it difficult or impossible to block via security software, simply because the bootkit always has a head start. Additionally, some bootkits have the capability to compromise security tools, which encrypt the entire contents of a hard drive. Even worse is that bootkits can still operate even if the user reinstalls an operating system; that's because they stay resident in memory each time the computer is turned on or rebooted. (Source: arstechnica.com)

Mandiant Consulting, the security firm which identified Nemesis (whose name comes from documents written by the people who created it), says a bootkit is "unusual, but not unknown." It notes that a previous piece of malware which used a bootkit was considered so valuable by cybercriminals that it was sold by its creator for $40,000 despite some questions over how well it worked.

Bootkit Weapon Currently Deployed to Banks

As things stand, Mandiant believes Nemesis is primarily being used to target financial institutions, either to directly steal confidential data, or as part of a high-stakes blackmail plot. However, it's argued that the problem could have wider ramifications, especially if the malware is used to target the general public.

The company says bootkits will require a complete rethink of many common anti-malware practices. It says security firms will need to develop tools which are better able to find rootkits and bootkits in the first place. It also warns that in most cases, the only safe solution is to physically wipe the data from affected hard drives before reinstalling the operating system. (Source: fireeye.com)

What's Your Opinion?

Do you believe there's a serious risk of criminals deploying bootkits in widespread attacks, or will they remain a tool for more focused targeting? Do you think it's realistic to try to tackle bootkits, or are they too fundamental a problem to solve?